feat: unify JacYac clients and integrate GitHub SSO and Ninja Scores

[marsninja]

Description

Turn the site's separate social, mobile, and leaderboard experiences into JacYac. Web and React Native share session handling, application state, validation, and branding while retaining their own UI components. The header CTA now says Join JacYac, uses the JacYac logo, and opens /jacyac.

• Integrate Ninja Scores into JacYac on web and mobile, with public browsing, search, sorting, score breakdowns, and submissions associated with JacYac profiles. Remove its site-wide navigation entry and redirect /leaderboard into JacYac. Preserve historical unowned entries under a labeled archive profile.

• Add GitHub sign-in, explicit account linking, and a picker limited to public repositories owned by the linked GitHub identity. Verify ownership by immutable provider ID. Document OAuth configuration; credentials are supplied through the server environment.

• Build reusable OAuth sessions into Jac Scale: PKCE, expiring single-use state bound to provider configuration, browser cookie binding for existing SSO routes, and expiring native results redeemed using a private device polling secret. Resolve accounts by provider ID instead of automatically merging matching emails.

• Consolidate duplicated social code and styling, retain inbound /socialize routes, and improve mobile layout, submission feedback, and removal confirmation.

• Align the live code tour with the current source, correct stacked-clip highlight scrolling, serve the mobile embed snippet live within its grid column, and verify the illustrative ownership diagnostics. Add regression coverage for all tour anchors and landing-page samples.

• Replace handwritten React effects with Jac lifecycle blocks, including closure-local cleanup for subscriptions, observers, and timers. Correct the client return diagnostic, register returned cleanup with Solid, and document synchronous and async cleanup semantics.

Validation

• Lifecycle migration: 52 tests passed, including real React Strict Mode and Solid cleanup behavior, return diagnostics, backend coverage, and code-clip regressions; 11 source checks passed. Rebuilt with jac run and checked theme synchronization, reveal/section navigation, game launch and route teardown, and desktop/narrow code clips using jac browse.
• Code clips: 5 regression tests and 7 source checks passed. All 23 deep-dive clips resolve and keep their highlights visible on desktop and at 390px width; scroll-back behavior and the live mobile embed clip were verified with jac browse.
• Application suite: 171 passed; added repository filtering/ownership tests: 3 passed; legacy migration test: 1 passed.
• Final application regression selection: 4 passed.
• Jac Scale SSO/provider/Firebase suite: 32 passed, including native result expiry and one-time redemption against the database.
• Application checks: 166 passed; mobile Android build check passed. Final header and mobile screen checks passed; formatting and whitespace checks completed.
• Ran the site with jac run and validated with jac browse: GitHub's real JacYac authorization page, password login, a real repository submission and score, anonymous browsing, legacy redirect, search, invalid-submission draft retention, and the React Native preview.

A personal GitHub login completing the live callback remains unconfirmed. Native UI validation used the browser preview and build checks, not a physical device.

[greptile-apps]

Too many files changed for review (137 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.